---
id: "age_secret_key"
kind: "datatype"
status: "draft"
is_pii: false
categories: ["secrets", "cryptography"]
langs: ["common"]
quality: 85
url: "http://registry.apicrafter.io/datatype/age_secret_key"
---

# age secret key (X25519 identity) (`age_secret_key`)

> **Draft.** Draft records have not been reviewed yet and may be incomplete or wrong; do not treat them as authoritative for legal or compliance decisions.

Secret key (identity) of the age file encryption format and tool, which decrypts files encrypted to the matching age1... public key. It is an uppercase Bech32 string with the human-readable part AGE-SECRET-KEY-, so it starts with AGE-SECRET-KEY-1 and has 74 characters. Post-quantum identities start with AGE-SECRET-KEY-PQ-1. The Bech32 checksum covers the whole string, including the hyphens of the prefix.

- Parent datatype: `private_key`
- Personal data (PII): no
- Categories: Secrets and credentials (passwords, keys, tokens) (secrets), Cryptographic identifiers (cryptography)
- Countries: global
- Languages: Common to most languages (common)
- Classification: identifier

## Detection

Regular expression (Python `re`):

```
^AGE-SECRET-KEY-(?:PQ-)?1[QPZRY9X8GF2TVDW0S3JN54KHCE6MUA7L]{58}$
```

## Examples

- `AGE-SECRET-KEY-1GFPYYSJZGFPYYSJZGFPYYSJZGFPYYSJZGFPYYSJZGFPYYSJZGFPQ4EGAEX` — X25519 test vector of the age specification
- `AGE-SECRET-KEY-PQ-1XX76JRALNLXDMEW0CRK45QMCCH4X06SE84UN3VPM33W6HWDX0H3SK3ZQFR` — Post-quantum (ML-KEM-768 + X25519) test vector of the age specification
- `age-secret-key-1gfpyysjzgfpyysjzgfpyysjzgfpyysjzgfpyysjzgfpyysjzgfpq4egaex` (invalid example) — Lower case

## Supported by tools

- `gitleaks`

## Sources

- doc: <https://github.com/C2SP/C2SP/blob/main/age.md>
- other: <https://github.com/gitleaks/gitleaks/blob/master/config/gitleaks.toml>

## Quality

Score 85/100. Missing: mapping (Wikidata, Schema.org, ...), translation.

JSON: <http://registry.apicrafter.io/api/v1/datatypes/age_secret_key.json> · Edit: <https://github.com/apicrafter/metacrafter-registry/edit/main/data/datatypes/any/secrets/age_secret_key.yaml>